Secure information flow by self-composition

Abstract

Information flow policies are confidentiality policies that control information leakage through program execution. A common means to enforce secure information flow is through information flow type systems. Although type systems are compositional and usually enjoy decidable type checking or inference, their extensibility is very poor: type systems need to be redefined and proven sound for each new single variation of security policy and programming language for which secure information flow verification is desired. In contrast, program logics offer a general mechanism to enforce a variety of safety policies, and for this reason are favored in Proof Carrying Code, a promising security architecture for mobile code. However, the encoding of information flow policies in program logics is not straightforward, because they refer to a relation between two program executions. The purpose of this paper is to investigate logical formulations of secure information flow based on the idea of self-composition, that reduces the problem of secure information flow of a program P to a safety property for a programP derived from P , by composing P with a renaming of itself. Self-composition enables the use of standard techniques for information flow policies verification, such as program logics and model checking, suitable in Proof Carrying Code infrastructures. We illustrate the applicability of self-composition in several settings, including different security policies such as non-interference and controlled forms of declassification, and programming languages such as an imperative language with parallel composition, a non-deterministic language, and finally a language with shared mutable data structures.

Computer-Aided Security Proofs for the Working Cryptographer

“…There are at least two natural strategies for defining a wp calculus in a relational setting. The calculus can either operate on both games in lockstep, or else it can operate on each game separately, in the style of self-composition [2]. Both strategies are incomplete: the lockstep wp calculus fails on programs that are not structurally equivalent, whereas self-composition fails to handle random assignments and adversary calls.…”

Beyond 2-Safety: Asymmetric Product Programs for Relational Program Verification

“…The embedding relies on separability; our conditions are inspired from self-composition [5], and are reminiscent of the monotonicity and frame properties of separation logic [19].…”

Qualitative and quantitative information flow analysis for multi-threaded programs

“…This restrictiveness makes practical programming impossible. Finally, the extensibility of type systems is very poor: each variant of the information flow policy or each new feature added to the programming language requires a modification of the type system and its soundness proof [15].…”

“…This thesis discusses a method to encode the information flow property as a temporal logic property. To do this, we implement the idea of self-composition -a construction where a program is composed with its copy and each program copy keeps an independent memory [34,15]. Basically, we construct a program model that executes the program to be verified twice, in parallel with itself.…”

“…• Thirdly, type systems are not very flexible, i.e., they need to be redefined and proven sound for each modification to the information security policy [15].…”